Overview
I designed and built the complete authentication flow. Enrollment converts three typing-timing samples into a per-user cadence profile; sign-in compares a new sample with that baseline using Pearson correlation and mean squared error, then falls back to a long passphrase after repeated failed attempts.
Resume highlights
- Secured 2 Flask services using 3-sample Pearson/MSE keystroke profiles, 20-character bcrypt fallback, 5-attempt/15-minute rate limiting, 60-second single-use codes, 1-hour JWTs, and atomic profile re-enrollment.
- Hardened login via CSRF, CORS allowlisting, JWT binding, callback validation, and server-to-server exchange.
Service architecture
I separated identity from the relying application: the authentication service owns credentials, cadence profiles, and verification, while the demo application delegates sign-up and sign-in. A short-lived, single-use code moves the result server-to-server, and the resulting session token never appears in a URL.
Security controls
- bcrypt-backed passphrase handling and generated application secrets
- CSRF protection, origin controls, and configurable lockout-based rate limiting
- JWT-bound requests and short-lived, single-use service exchange codes
- An end-to-end smoke test covering account creation, three-sample enrollment, and authentication
Design rationale
I used transparent statistical similarity rather than presenting the system as a trained classifier. This kept verification behavior explainable while focusing the project on secure enrollment, service-to-service handoff, failure handling, and a conventional fallback path.
Project details
- Language
- Python
- Architecture
- Flask identity provider and relying application
- Storage
- SQLite
- Scoring
- Pearson correlation and mean squared error
- Validation
- End-to-end account, enrollment, and sign-in smoke test